ProKYC deepfake tool exploited to bypass crypto exchange identity verification
Cybersecurity firm Cato Networks reported that a deepfake tool called ProKYC is being sold to criminals to create fake verified accounts on crypto exchanges by forging identity documents and deepfake videos that bypass facial recognition verification. The tool successfully demonstrated bypass of KYC protocols on exchange Bybit and is marketed to defraud financial platforms including Stripe and Revolut.
What happened
Bad actors are selling a deepfake tool called ProKYC in underground markets that enables users to bypass crypto exchange identity authentication systems. The tool generates AI-rendered faces, creates deepfake identity documents such as passports, and produces accompanying deepfake videos designed to pass facial recognition challenges.
According to a demonstration video provided by ProKYC, the tool successfully bypassed KYC protocols on the Dubai-based crypto exchange Bybit by creating an AI-generated face integrated into an Australian passport template and a corresponding deepfake video. The tool is also marketed as capable of bypassing KYC measures for payment platforms Stripe and Revolut.
Reported impact
Threat actors use the tool to create verified synthetic accounts for money laundering, fraud, and mule account operations rather than to compromise existing accounts. New account fraud using such methods accounted for over $5.3 billion in losses in 2023, according to AARP data cited by Cato Networks.
Index analysis
Cato Networks characterized the ProKYC tool as representing 'a new level of sophistication' in crypto fraud, marking a significant advancement over traditional methods of bypassing two-factor authentication and obtaining forged documents from the dark web. The tool allows fraudsters to create entirely new identities using AI rather than relying on purchased forged documents.
Governance controls
Cato Networks recommended that crypto exchanges update their security systems to combat new account fraud attacks and collect threat intelligence from human, open-source, and other sources to stay current on cybercrime trends.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.